Napcat Qq Bridge Installer

Install, start, repair, and smoke-test a Windows QQ + NapCat + OpenClaw bridge. Use this when the user explicitly wants an end-to-end local QQ bot setup, nee...

This skill appears to do what it says, but it performs intrusive local operations that you should understand before running: it will download and extract NapCat code from GitHub, install Tencent.QQ.NT via winget if needed, write configuration and token files into the chosen runtime folder, create/start a Docker container in WSL, and launch NapCat by injecting/starting helper executables/DLLs into the QQ process. Only install/run this on a machine you control and trust (or inside a VM). Review the downloaded NapCat release and bundled files before executing, be prepared to approve admin elevation, and expect a manual browser OAuth step for OpenClaw/OpenAI onboarding. If you need higher assurance, download NapCat manually (or verify release checksums) and inspect the extracted binaries before using the automated installer.

Type: OpenClaw Skill Name: napcat-qq-bridge-installer Version: 1.0.1 The skill automates the setup of an unofficial QQ bot bridge using NapCat, which involves high-risk operations including DLL injection into the QQ client, modifying the Windows registry, and installing software via winget (scripts/manage.py). The bridge component (bridge.mjs) executes shell commands through WSL/Docker to interact with the OpenClaw agent, creating a significant attack surface for potential command injection. While these actions appear aligned with the stated goal of local bot automation, the combination of binary downloads from GitHub, administrative privilege requirements, and the use of hooking techniques warrants a suspicious classification.